@mondaydotcomorg/atp-provenance 0.18.4-rc.1 → 0.19.1

package/dist/policies/__tests__/declarative.test.js

@@ -0,0 +1,109 @@
+import { createDeclarativePolicy } from '../declarative.js';
+import { createProvenanceProxy, setGlobalProvenanceStore } from '../../registry.js';
+import { ProvenanceSource } from '../../types.js';
+import { InMemoryProvenanceStore } from '../../store.js';
+describe('Declarative Policies', () => {
+    beforeAll(() => {
+        setGlobalProvenanceStore(new InMemoryProvenanceStore());
+    });
+    const userSource = {
+        type: ProvenanceSource.USER,
+        timestamp: Date.now(),
+    };
+    const toolSource = {
+        type: ProvenanceSource.TOOL,
+        toolName: 'getUser',
+        apiGroup: 'users',
+        timestamp: Date.now(),
+    };
+    const policyConfig = {
+        id: 'test-policy',
+        scope: {
+            toolName: 'send',
+        },
+        rules: [
+            {
+                id: 'block-external-user-data',
+                action: 'block',
+                conditions: [
+                    {
+                        field: 'args.to',
+                        operator: 'notEndsWith',
+                        value: '@company.com',
+                    },
+                    {
+                        field: 'provenance.args.body.source.type',
+                        operator: 'equals',
+                        value: 'user',
+                    },
+                ],
+                reason: 'Cannot send user data to external email',
+            },
+        ],
+    };
+    const policy = createDeclarativePolicy(policyConfig);
+    it('should ignore calls outside of scope', async () => {
+        const result = await policy.check('otherTool', { to: 'external@gmail.com' }, () => null);
+        expect(result.action).toBe('log'); // Default allow
+    });
+    it('should block when conditions match', async () => {
+        const userData = createProvenanceProxy({ data: 'sensitive' }, userSource);
+        const { getProvenance } = await import('../../registry.js');
+        const result = await policy.check('send', {
+            to: 'attacker@evil.com',
+            body: userData,
+        }, getProvenance);
+        expect(result.action).toBe('block');
+        expect(result.reason).toBe('Cannot send user data to external email');
+    });
+    it('should allow when conditions do not match (email is internal)', async () => {
+        const userData = createProvenanceProxy({ data: 'sensitive' }, userSource);
+        const { getProvenance } = await import('../../registry.js');
+        const result = await policy.check('send', {
+            to: 'alice@company.com',
+            body: userData,
+        }, getProvenance);
+        expect(result.action).toBe('log'); // Default allow
+    });
+    it('should allow when conditions do not match (data is not user source)', async () => {
+        const toolData = createProvenanceProxy({ data: 'public info' }, toolSource);
+        const { getProvenance } = await import('../../registry.js');
+        const result = await policy.check('send', {
+            to: 'attacker@evil.com',
+            body: toolData,
+        }, getProvenance);
+        expect(result.action).toBe('log'); // Default allow
+    });
+    it('should handle nested provenance paths', async () => {
+        const complexPolicyConfig = {
+            id: 'nested-test',
+            scope: { toolName: 'update' },
+            rules: [
+                {
+                    action: 'block',
+                    conditions: [
+                        {
+                            field: 'provenance.args.user.profile.email.source.type',
+                            operator: 'equals',
+                            value: 'user',
+                        },
+                    ],
+                },
+            ],
+        };
+        const complexPolicy = createDeclarativePolicy(complexPolicyConfig);
+        const { getProvenance } = await import('../../registry.js');
+        // Create a user object where the nested properties have provenance
+        const user = createProvenanceProxy({
+            profile: {
+                email: 'test@test.com',
+            },
+        }, userSource);
+        const args = {
+            user,
+        };
+        const result = await complexPolicy.check('update', args, getProvenance);
+        expect(result.action).toBe('block');
+    });
+});
+//# sourceMappingURL=declarative.test.js.map

package/dist/policies/__tests__/declarative.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarative.test.js","sourceRoot":"","sources":["../../../src/policies/__tests__/declarative.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAuB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACrC,SAAS,CAAC,GAAG,EAAE;QACd,wBAAwB,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAmB;QAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,MAAM,UAAU,GAAmB;QAClC,IAAI,EAAE,gBAAgB,CAAC,IAAI;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACrB,CAAC;IAEF,MAAM,YAAY,GAAG;QACpB,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE;YACN,QAAQ,EAAE,MAAM;SAChB;QACD,KAAK,EAAE;YACN;gBACC,EAAE,EAAE,0BAA0B;gBAC9B,MAAM,EAAE,OAAgB;gBACxB,UAAU,EAAE;oBACX;wBACC,KAAK,EAAE,SAAS;wBAChB,QAAQ,EAAE,aAAsB;wBAChC,KAAK,EAAE,cAAc;qBACrB;oBACD;wBACC,KAAK,EAAE,kCAAkC;wBACzC,QAAQ,EAAE,QAAiB;wBAC3B,KAAK,EAAE,MAAM;qBACb;iBACD;gBACD,MAAM,EAAE,yCAAyC;aACjD;SACD;KACD,CAAC;IAEF,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAErD,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QACnD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;QAE1E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,MAAM,EACN;YACC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,QAAQ;SACd,EACD,aAAa,CACb,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,MAAM,EACN;YACC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,QAAQ;SACd,EACD,aAAa,CACb,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACpF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,CAAC,CAAC;QAC5E,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC,MAAM,EACN;YACC,EAAE,EAAE,mBAAmB;YACvB,IAAI,EAAE,QAAQ;SACd,EACD,aAAa,CACb,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,mBAAmB,GAAG;YAC3B,EAAE,EAAE,aAAa;YACjB,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC7B,KAAK,EAAE;gBACN;oBACC,MAAM,EAAE,OAAgB;oBACxB,UAAU,EAAE;wBACX;4BACC,KAAK,EAAE,gDAAgD;4BACvD,QAAQ,EAAE,QAAiB;4BAC3B,KAAK,EAAE,MAAM;yBACb;qBACD;iBACD;aACD;SACD,CAAC;QAEF,MAAM,aAAa,GAAG,uBAAuB,CAAC,mBAAmB,CAAC,CAAC;QACnE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAE5D,mEAAmE;QACnE,MAAM,IAAI,GAAG,qBAAqB,CACjC;YACC,OAAO,EAAE;gBACR,KAAK,EAAE,eAAe;aACtB;SACD,EACD,UAAU,CACV,CAAC;QAEF,MAAM,IAAI,GAAG;YACZ,IAAI;SACJ,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/policies/builder.d.ts

@@ -0,0 +1,36 @@
+import type { DeclarativePolicyConfig, PolicyRule, Operator } from './declarative.js';
+import type { PolicyAction } from '../types.js';
+/**
+ * Helper class to build policy rules fluently
+ */
+export declare class RuleBuilder {
+    private rule;
+    constructor(action?: PolicyAction);
+    action(action: PolicyAction): this;
+    id(id: string): this;
+    reason(reason: string): this;
+    condition(field: string, operator: Operator, value: any): this;
+    build(): PolicyRule;
+}
+/**
+ * Helper class to build declarative policies fluently
+ */
+export declare class PolicyBuilder {
+    private config;
+    constructor(id: string);
+    description(desc: string): this;
+    scopeTool(toolNamePattern: string): this;
+    scopeApiGroup(apiGroupPattern: string): this;
+    /**
+     * Add a rule using a builder callback
+     * @example
+     * .addRule(r => r.action('block').condition('args.amount', 'matches', '>1000'))
+     */
+    addRule(buildFn: (builder: RuleBuilder) => RuleBuilder): this;
+    /**
+     * Add a fully formed rule object
+     */
+    addRuleObject(rule: PolicyRule): this;
+    build(): DeclarativePolicyConfig;
+}
+//# sourceMappingURL=builder.d.ts.map

package/dist/policies/builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.d.ts","sourceRoot":"","sources":["../../src/policies/builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD;;GAEG;AACH,qBAAa,WAAW;IACvB,OAAO,CAAC,IAAI,CAGV;gBAEU,MAAM,GAAE,YAAoB;IAIxC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAKlC,EAAE,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAKpB,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK5B,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,GAAG,IAAI;IAK9D,KAAK,IAAI,UAAU;CAGnB;AAED;;GAEG;AACH,qBAAa,aAAa;IACzB,OAAO,CAAC,MAAM,CAA0B;gBAE5B,EAAE,EAAE,MAAM;IAQtB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAK/B,SAAS,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;IAKxC,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI;IAK5C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,WAAW,GAAG,IAAI;IAM7D;;OAEG;IACH,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAKrC,KAAK,IAAI,uBAAuB;CAGhC"}

package/dist/policies/builder.js

@@ -0,0 +1,77 @@
+/**
+ * Helper class to build policy rules fluently
+ */
+export class RuleBuilder {
+    rule = {
+        action: 'log',
+        conditions: [],
+    };
+    constructor(action = 'log') {
+        this.rule.action = action;
+    }
+    action(action) {
+        this.rule.action = action;
+        return this;
+    }
+    id(id) {
+        this.rule.id = id;
+        return this;
+    }
+    reason(reason) {
+        this.rule.reason = reason;
+        return this;
+    }
+    condition(field, operator, value) {
+        this.rule.conditions.push({ field, operator, value });
+        return this;
+    }
+    build() {
+        return this.rule;
+    }
+}
+/**
+ * Helper class to build declarative policies fluently
+ */
+export class PolicyBuilder {
+    config;
+    constructor(id) {
+        this.config = {
+            id,
+            scope: {},
+            rules: [],
+        };
+    }
+    description(desc) {
+        this.config.description = desc;
+        return this;
+    }
+    scopeTool(toolNamePattern) {
+        this.config.scope.toolName = toolNamePattern;
+        return this;
+    }
+    scopeApiGroup(apiGroupPattern) {
+        this.config.scope.apiGroup = apiGroupPattern;
+        return this;
+    }
+    /**
+     * Add a rule using a builder callback
+     * @example
+     * .addRule(r => r.action('block').condition('args.amount', 'matches', '>1000'))
+     */
+    addRule(buildFn) {
+        const builder = new RuleBuilder();
+        this.config.rules.push(buildFn(builder).build());
+        return this;
+    }
+    /**
+     * Add a fully formed rule object
+     */
+    addRuleObject(rule) {
+        this.config.rules.push(rule);
+        return this;
+    }
+    build() {
+        return this.config;
+    }
+}
+//# sourceMappingURL=builder.js.map

package/dist/policies/builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder.js","sourceRoot":"","sources":["../../src/policies/builder.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,OAAO,WAAW;IACf,IAAI,GAAe;QAC1B,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,EAAE;KACd,CAAC;IAEF,YAAY,SAAuB,KAAK;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,MAAoB;QAC1B,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,EAAE,CAAC,EAAU;QACZ,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,CAAC,MAAc;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC1B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,QAAkB,EAAE,KAAU;QACtD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,CAAC,IAAI,CAAC;IAClB,CAAC;CACD;AAED;;GAEG;AACH,MAAM,OAAO,aAAa;IACjB,MAAM,CAA0B;IAExC,YAAY,EAAU;QACrB,IAAI,CAAC,MAAM,GAAG;YACb,EAAE;YACF,KAAK,EAAE,EAAE;YACT,KAAK,EAAE,EAAE;SACT,CAAC;IACH,CAAC;IAED,WAAW,CAAC,IAAY;QACvB,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,IAAI,CAAC;QAC/B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,SAAS,CAAC,eAAuB;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC;QAC7C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,aAAa,CAAC,eAAuB;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC;QAC7C,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,OAA8C;QACrD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAgB;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACb,CAAC;IAED,KAAK;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;CACD"}

package/dist/policies/declarative.d.ts

@@ -0,0 +1,47 @@
+import type { SecurityPolicy, PolicyAction } from '../types.js';
+export type Operator = 'equals' | 'notEquals' | 'contains' | 'notContains' | 'startsWith' | 'notStartsWith' | 'endsWith' | 'notEndsWith' | 'matches' | 'in' | 'notIn';
+export interface Condition {
+    /**
+     * Field to check.
+     * - "args.paramName": Value of a tool argument
+     * - "provenance.args.paramName.source.type": Provenance metadata
+     * - "provenance.args.paramName.readers": Reader permissions
+     */
+    field: string;
+    operator: Operator;
+    value: any;
+}
+export interface PolicyRule {
+    id?: string;
+    /** Action to take if conditions match */
+    action: PolicyAction;
+    /** Conditions (implicit AND) - all must match for the rule to trigger */
+    conditions: Condition[];
+    /** Custom reason message */
+    reason?: string;
+}
+export interface DeclarativePolicyConfig {
+    id: string;
+    description?: string;
+    scope: {
+        /** Regex pattern or exact match for tool name */
+        toolName?: string;
+        /** Regex pattern or exact match for API group */
+        apiGroup?: string;
+    };
+    /** Rules are evaluated in order. First match wins. */
+    rules: PolicyRule[];
+}
+export interface PolicyConfiguration {
+    version: string;
+    policies: DeclarativePolicyConfig[];
+}
+/**
+ * Create a SecurityPolicy from a declarative configuration
+ */
+export declare function createDeclarativePolicy(config: DeclarativePolicyConfig): SecurityPolicy;
+/**
+ * Load policies from a full configuration object or array of policy configs
+ */
+export declare function loadDeclarativePolicies(config: PolicyConfiguration | DeclarativePolicyConfig[]): SecurityPolicy[];
+//# sourceMappingURL=declarative.d.ts.map

package/dist/policies/declarative.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarative.d.ts","sourceRoot":"","sources":["../../src/policies/declarative.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAoC,YAAY,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,MAAM,QAAQ,GACjB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,aAAa,GACb,YAAY,GACZ,eAAe,GACf,UAAU,GACV,aAAa,GACb,SAAS,GACT,IAAI,GACJ,OAAO,CAAC;AAEX,MAAM,WAAW,SAAS;IACzB;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,EAAE,GAAG,CAAC;CACX;AAED,MAAM,WAAW,UAAU;IAC1B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,MAAM,EAAE,YAAY,CAAC;IACrB,yEAAyE;IACzE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE;QACN,iDAAiD;QACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,iDAAiD;QACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,sDAAsD;IACtD,KAAK,EAAE,UAAU,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,uBAAuB,EAAE,CAAC;CACpC;AAuID;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,cAAc,CAyCvF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,mBAAmB,GAAG,uBAAuB,EAAE,GACrD,cAAc,EAAE,CAKlB"}

package/dist/policies/declarative.js

@@ -0,0 +1,170 @@
+/**
+ * Resolve a value from a path in the arguments or provenance
+ */
+function resolveValue(path, args, getProvenance) {
+    const parts = path.split('.');
+    const root = parts.shift();
+    if (root === 'args') {
+        let current = args;
+        for (const part of parts) {
+            if (current === null || current === undefined) {
+                return undefined;
+            }
+            current = current[part];
+        }
+        return current;
+    }
+    if (root === 'provenance' && parts[0] === 'args') {
+        parts.shift(); // remove 'args'
+        const argName = parts.shift(); // get argument name
+        if (!argName)
+            return undefined;
+        const argValue = args[argName];
+        // Better approach:
+        // 1. Traverse args until we find the object.
+        // 2. Get provenance of that object.
+        // 3. Traverse provenance metadata.
+        let remainingParts = [...parts];
+        // We don't know where the split is.
+        // Let's try to find standard metadata keys in the path.
+        const metadataKeys = ['source', 'readers', 'dependencies', 'id', 'context'];
+        let splitIndex = -1;
+        for (let i = 0; i < remainingParts.length; i++) {
+            if (metadataKeys.includes(remainingParts[i])) {
+                splitIndex = i;
+                break;
+            }
+        }
+        if (splitIndex === -1) {
+            return undefined;
+        }
+        // Traverse to the value that should have provenance
+        let valuePath = remainingParts.slice(0, splitIndex);
+        let metaPath = remainingParts.slice(splitIndex);
+        let currentVal = argValue;
+        for (const part of valuePath) {
+            if (currentVal === null || currentVal === undefined)
+                return undefined;
+            currentVal = currentVal[part];
+        }
+        const metadata = getProvenance(currentVal);
+        if (!metadata)
+            return undefined;
+        // Now traverse metadata
+        let currentMeta = metadata;
+        for (const part of metaPath) {
+            if (currentMeta === null || currentMeta === undefined)
+                return undefined;
+            currentMeta = currentMeta[part];
+        }
+        return currentMeta;
+    }
+    return undefined;
+}
+function evaluateCondition(actual, operator, expected) {
+    switch (operator) {
+        case 'equals':
+            return actual === expected;
+        case 'notEquals':
+            return actual !== expected;
+        case 'contains':
+            return Array.isArray(actual) || typeof actual === 'string'
+                ? actual.includes(expected)
+                : false;
+        case 'notContains':
+            return Array.isArray(actual) || typeof actual === 'string'
+                ? !actual.includes(expected)
+                : true;
+        case 'startsWith':
+            return typeof actual === 'string' ? actual.startsWith(expected) : false;
+        case 'notStartsWith':
+            return typeof actual === 'string' ? !actual.startsWith(expected) : true;
+        case 'endsWith':
+            return typeof actual === 'string' ? actual.endsWith(expected) : false;
+        case 'notEndsWith':
+            return typeof actual === 'string' ? !actual.endsWith(expected) : true;
+        case 'matches':
+            if (typeof actual === 'string') {
+                return new RegExp(expected).test(actual);
+            }
+            if (typeof actual === 'number' && typeof expected === 'string') {
+                const match = expected.match(/^([<>]=?|==|!=)(\d+(?:\.\d+)?)$/);
+                if (match) {
+                    const [, op, value] = match;
+                    const numValue = parseFloat(value);
+                    switch (op) {
+                        case '>':
+                            return actual > numValue;
+                        case '>=':
+                            return actual >= numValue;
+                        case '<':
+                            return actual < numValue;
+                        case '<=':
+                            return actual <= numValue;
+                        case '==':
+                            return actual === numValue;
+                        case '!=':
+                            return actual !== numValue;
+                    }
+                }
+            }
+            return false;
+        case 'in':
+            return Array.isArray(expected) ? expected.includes(actual) : false;
+        case 'notIn':
+            return Array.isArray(expected) ? !expected.includes(actual) : true;
+        default:
+            return false;
+    }
+}
+/**
+ * Create a SecurityPolicy from a declarative configuration
+ */
+export function createDeclarativePolicy(config) {
+    return {
+        name: config.id,
+        description: config.description,
+        check: async (toolName, args, getProvenance) => {
+            if (config.scope.toolName) {
+                const toolRegex = new RegExp(`^${config.scope.toolName}$`);
+                if (!toolRegex.test(toolName)) {
+                    return { action: 'log' };
+                }
+            }
+            if (config.scope.apiGroup) {
+                // Note: apiGroup is matched against the toolName prefix (e.g., "payment" from "payment.transfer")
+                // The SecurityPolicy interface doesn't receive apiGroup separately, but we can extract it from toolName
+                const extractedGroup = toolName.split('.')[0] || '';
+                const groupRegex = new RegExp(`^${config.scope.apiGroup}$`);
+                if (!groupRegex.test(extractedGroup)) {
+                    return { action: 'log' };
+                }
+            }
+            for (const rule of config.rules) {
+                const allMatch = rule.conditions.every((condition) => {
+                    const actualValue = resolveValue(condition.field, args, getProvenance);
+                    return evaluateCondition(actualValue, condition.operator, condition.value);
+                });
+                if (allMatch) {
+                    return {
+                        action: rule.action,
+                        reason: rule.reason || `Matched rule ${rule.id || 'unknown'} in policy ${config.id}`,
+                        policy: config.id,
+                        context: { ruleId: rule.id, conditions: rule.conditions },
+                    };
+                }
+            }
+            return { action: 'log' };
+        },
+    };
+}
+/**
+ * Load policies from a full configuration object or array of policy configs
+ */
+export function loadDeclarativePolicies(config) {
+    if (Array.isArray(config)) {
+        return config.map(createDeclarativePolicy);
+    }
+    return config.policies.map(createDeclarativePolicy);
+}
+//# sourceMappingURL=declarative.js.map

package/dist/policies/declarative.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarative.js","sourceRoot":"","sources":["../../src/policies/declarative.ts"],"names":[],"mappings":"AAuDA;;GAEG;AACH,SAAS,YAAY,CACpB,IAAY,EACZ,IAA6B,EAC7B,aAA4D;IAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;IAE3B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,OAAO,GAAQ,IAAI,CAAC;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC/C,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAClD,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,oBAAoB;QACnD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/B,mBAAmB;QACnB,6CAA6C;QAC7C,oCAAoC;QACpC,mCAAmC;QAEnC,IAAI,cAAc,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAEhC,oCAAoC;QACpC,wDAAwD;QACxD,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC5E,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBAC/C,UAAU,GAAG,CAAC,CAAC;gBACf,MAAM;YACP,CAAC;QACF,CAAC;QAED,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,oDAAoD;QACpD,IAAI,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACpD,IAAI,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEhD,IAAI,UAAU,GAAG,QAAQ,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACtE,UAAU,GAAI,UAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,wBAAwB;QACxB,IAAI,WAAW,GAAQ,QAAQ,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC7B,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxE,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAW,EAAE,QAAkB,EAAE,QAAa;IACxE,QAAQ,QAAQ,EAAE,CAAC;QAClB,KAAK,QAAQ;YACZ,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC5B,KAAK,WAAW;YACf,OAAO,MAAM,KAAK,QAAQ,CAAC;QAC5B,KAAK,UAAU;YACd,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,CAAC,CAAC,KAAK,CAAC;QACV,KAAK,aAAa;YACjB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,KAAK,QAAQ;gBACzD,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC5B,CAAC,CAAC,IAAI,CAAC;QACT,KAAK,YAAY;YAChB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACzE,KAAK,eAAe;YACnB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,KAAK,UAAU;YACd,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACvE,KAAK,aAAa;YACjB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,KAAK,SAAS;YACb,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAChC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChE,IAAI,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;oBAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAM,CAAC,CAAC;oBACpC,QAAQ,EAAE,EAAE,CAAC;wBACZ,KAAK,GAAG;4BACP,OAAO,MAAM,GAAG,QAAQ,CAAC;wBAC1B,KAAK,IAAI;4BACR,OAAO,MAAM,IAAI,QAAQ,CAAC;wBAC3B,KAAK,GAAG;4BACP,OAAO,MAAM,GAAG,QAAQ,CAAC;wBAC1B,KAAK,IAAI;4BACR,OAAO,MAAM,IAAI,QAAQ,CAAC;wBAC3B,KAAK,IAAI;4BACR,OAAO,MAAM,KAAK,QAAQ,CAAC;wBAC5B,KAAK,IAAI;4BACR,OAAO,MAAM,KAAK,QAAQ,CAAC;oBAC7B,CAAC;gBACF,CAAC;YACF,CAAC;YACD,OAAO,KAAK,CAAC;QACd,KAAK,IAAI;YACR,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACpE,KAAK,OAAO;YACX,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE;YACC,OAAO,KAAK,CAAC;IACf,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACtE,OAAO;QACN,IAAI,EAAE,MAAM,CAAC,EAAE;QACf,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;YAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC3D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC1B,CAAC;YACF,CAAC;YAED,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,kGAAkG;gBAClG,wGAAwG;gBACxG,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACpD,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAC5D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC1B,CAAC;YACF,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACpD,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;oBACvE,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;gBAC5E,CAAC,CAAC,CAAC;gBAEH,IAAI,QAAQ,EAAE,CAAC;oBACd,OAAO;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,gBAAgB,IAAI,CAAC,EAAE,IAAI,SAAS,cAAc,MAAM,CAAC,EAAE,EAAE;wBACpF,MAAM,EAAE,MAAM,CAAC,EAAE;wBACjB,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;qBACzD,CAAC;gBACH,CAAC;YACF,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;KACD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACtC,MAAuD;IAEvD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AACrD,CAAC"}

package/dist/policies/dynamic.d.ts

@@ -0,0 +1,39 @@
+import type { SecurityPolicy, PolicyResult, ProvenanceMetadata } from '../types.js';
+import { type DeclarativePolicyConfig } from './declarative.js';
+/**
+ * A dynamic registry that manages multiple policies and acts as a single SecurityPolicy.
+ * This allows policies to be updated at runtime (e.g. from a UI or database) without restarting the server.
+ */
+export declare class DynamicPolicyRegistry implements SecurityPolicy {
+    name: string;
+    description: string;
+    private policies;
+    constructor(initialPolicies?: SecurityPolicy[]);
+    /**
+     * Add or update a policy
+     */
+    addPolicy(policy: SecurityPolicy): void;
+    /**
+     * Remove a policy by name
+     */
+    removePolicy(name: string): void;
+    /**
+     * clear all policies
+     */
+    clear(): void;
+    /**
+     * Load policies from declarative configurations (JSON)
+     * This is useful for loading policies saved from a UI
+     */
+    loadFromConfigs(configs: DeclarativePolicyConfig[], replace?: boolean): void;
+    /**
+     * Get all registered policies
+     */
+    getPolicies(): SecurityPolicy[];
+    /**
+     * Implementation of the SecurityPolicy check interface.
+     * Delegates to all registered policies.
+     */
+    check(toolName: string, args: Record<string, unknown>, getProvenance: (value: unknown) => ProvenanceMetadata | null): Promise<PolicyResult>;
+}
+//# sourceMappingURL=dynamic.d.ts.map

package/dist/policies/dynamic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic.d.ts","sourceRoot":"","sources":["../../src/policies/dynamic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAA2B,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEzF;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,cAAc;IAC3D,IAAI,SAA6B;IACjC,WAAW,SAAyD;IAEpE,OAAO,CAAC,QAAQ,CAA0C;gBAE9C,eAAe,GAAE,cAAc,EAAO;IAMlD;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIvC;;OAEG;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIhC;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,eAAe,CAAC,OAAO,EAAE,uBAAuB,EAAE,EAAE,OAAO,UAAQ,GAAG,IAAI;IAU1E;;OAEG;IACH,WAAW,IAAI,cAAc,EAAE;IAI/B;;;OAGG;IACG,KAAK,CACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,aAAa,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,kBAAkB,GAAG,IAAI,GAC1D,OAAO,CAAC,YAAY,CAAC;CAuBxB"}

package/dist/policies/dynamic.js

@@ -0,0 +1,75 @@
+import { createDeclarativePolicy } from './declarative.js';
+/**
+ * A dynamic registry that manages multiple policies and acts as a single SecurityPolicy.
+ * This allows policies to be updated at runtime (e.g. from a UI or database) without restarting the server.
+ */
+export class DynamicPolicyRegistry {
+    name = 'dynamic-policy-registry';
+    description = 'Container for dynamically managed security policies';
+    policies = new Map();
+    constructor(initialPolicies = []) {
+        for (const policy of initialPolicies) {
+            this.policies.set(policy.name, policy);
+        }
+    }
+    /**
+     * Add or update a policy
+     */
+    addPolicy(policy) {
+        this.policies.set(policy.name, policy);
+    }
+    /**
+     * Remove a policy by name
+     */
+    removePolicy(name) {
+        this.policies.delete(name);
+    }
+    /**
+     * clear all policies
+     */
+    clear() {
+        this.policies.clear();
+    }
+    /**
+     * Load policies from declarative configurations (JSON)
+     * This is useful for loading policies saved from a UI
+     */
+    loadFromConfigs(configs, replace = false) {
+        if (replace) {
+            this.policies.clear();
+        }
+        for (const config of configs) {
+            const policy = createDeclarativePolicy(config);
+            this.policies.set(policy.name, policy);
+        }
+    }
+    /**
+     * Get all registered policies
+     */
+    getPolicies() {
+        return Array.from(this.policies.values());
+    }
+    /**
+     * Implementation of the SecurityPolicy check interface.
+     * Delegates to all registered policies.
+     */
+    async check(toolName, args, getProvenance) {
+        let requiresApproval = null;
+        for (const policy of this.policies.values()) {
+            const result = await policy.check(toolName, args, getProvenance);
+            if (result.action === 'block') {
+                return result;
+            }
+            if (result.action === 'approve') {
+                if (!requiresApproval) {
+                    requiresApproval = result;
+                }
+            }
+        }
+        if (requiresApproval) {
+            return requiresApproval;
+        }
+        return { action: 'log' };
+    }
+}
+//# sourceMappingURL=dynamic.js.map

package/dist/policies/dynamic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dynamic.js","sourceRoot":"","sources":["../../src/policies/dynamic.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAgC,MAAM,kBAAkB,CAAC;AAEzF;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACjC,IAAI,GAAG,yBAAyB,CAAC;IACjC,WAAW,GAAG,qDAAqD,CAAC;IAE5D,QAAQ,GAAgC,IAAI,GAAG,EAAE,CAAC;IAE1D,YAAY,kBAAoC,EAAE;QACjD,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,MAAsB;QAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,IAAY;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,KAAK;QACJ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,OAAkC,EAAE,OAAO,GAAG,KAAK;QAClE,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED;;OAEG;IACH,WAAW;QACV,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CACV,QAAgB,EAChB,IAA6B,EAC7B,aAA4D;QAE5D,IAAI,gBAAgB,GAAwB,IAAI,CAAC;QAEjD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAEjE,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC;YACf,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACvB,gBAAgB,GAAG,MAAM,CAAC;gBAC3B,CAAC;YACF,CAAC;QACF,CAAC;QAED,IAAI,gBAAgB,EAAE,CAAC;YACtB,OAAO,gBAAgB,CAAC;QACzB,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;CACD"}