@paystage/policy 0.1.0 → 0.2.0

package/dist/schema.d.ts

@@ -6,115 +6,44 @@ export declare const PolicySchema: z.ZodObject<{
         value: z.ZodString;
         asset: z.ZodString;
         decimals: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }>;
+    }, z.core.$strip>;
     daily_cap: z.ZodOptional<z.ZodObject<{
         value: z.ZodString;
         asset: z.ZodString;
         decimals: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }>>;
-    allowed_pay_to: z.ZodArray<z.ZodString, "many">;
+    }, z.core.$strip>>;
+    allowed_pay_to: z.ZodArray<z.ZodString>;
     allowed_assets: z.ZodArray<z.ZodObject<{
         symbol: z.ZodString;
         decimals: z.ZodNumber;
         address: z.ZodString;
         network: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        symbol: string;
-        decimals: number;
-        address: string;
-        network: string;
-    }, {
-        symbol: string;
-        decimals: number;
-        address: string;
-        network: string;
-    }>, "many">;
-    allowed_networks: z.ZodArray<z.ZodString, "many">;
+    }, z.core.$strip>>;
+    allowed_networks: z.ZodArray<z.ZodString>;
     max_timeout_seconds: z.ZodNumber;
     require_human_above: z.ZodOptional<z.ZodObject<{
         value: z.ZodString;
         asset: z.ZodString;
         decimals: z.ZodNumber;
-    }, "strip", z.ZodTypeAny, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }, {
-        value: string;
-        asset: string;
-        decimals: number;
-    }>>;
-    unknown_payee: z.ZodEnum<["review", "deny"]>;
-}, "strip", z.ZodTypeAny, {
-    version: 1;
-    max_amount: {
-        value: string;
-        asset: string;
-        decimals: number;
-    };
-    allowed_pay_to: string[];
-    allowed_assets: {
-        symbol: string;
-        decimals: number;
-        address: string;
-        network: string;
-    }[];
-    allowed_networks: string[];
-    max_timeout_seconds: number;
-    unknown_payee: "review" | "deny";
-    daily_cap?: {
-        value: string;
-        asset: string;
-        decimals: number;
-    } | undefined;
-    require_human_above?: {
-        value: string;
-        asset: string;
-        decimals: number;
-    } | undefined;
-}, {
-    version: 1;
-    max_amount: {
-        value: string;
-        asset: string;
-        decimals: number;
-    };
-    allowed_pay_to: string[];
-    allowed_assets: {
-        symbol: string;
-        decimals: number;
-        address: string;
-        network: string;
-    }[];
-    allowed_networks: string[];
-    max_timeout_seconds: number;
-    unknown_payee: "review" | "deny";
-    daily_cap?: {
-        value: string;
-        asset: string;
-        decimals: number;
-    } | undefined;
-    require_human_above?: {
-        value: string;
-        asset: string;
-        decimals: number;
-    } | undefined;
-}>;
+    }, z.core.$strip>>;
+    unknown_payee: z.ZodEnum<{
+        review: "review";
+        deny: "deny";
+    }>;
+    max_auth_validity_seconds: z.ZodOptional<z.ZodNumber>;
+    allowed_spenders: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    disallow_unlimited_approvals: z.ZodOptional<z.ZodBoolean>;
+    velocity: z.ZodOptional<z.ZodObject<{
+        windows: z.ZodArray<z.ZodObject<{
+            window_seconds: z.ZodNumber;
+            max_count: z.ZodOptional<z.ZodNumber>;
+            max_amount: z.ZodOptional<z.ZodObject<{
+                value: z.ZodString;
+                decimals: z.ZodNumber;
+                asset: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export type PolicyFromSchema = z.infer<typeof PolicySchema>;
 export type ParsedPolicy = Policy;

package/dist/schema.js

@@ -17,6 +17,18 @@ const assetSchema = z.object({
         .string()
         .regex(/^eip155:\d+$/, "Expected a network id like eip155:8453")
 });
+const velocityAmountSchema = z.object({
+    value: z
+        .string()
+        .regex(/^\d+(?:\.\d+)?$/, "Amount value must be a non-negative decimal string"),
+    decimals: z.number().int().min(0),
+    asset: z.string().min(1).optional(),
+});
+const velocityWindowSchema = z.object({
+    window_seconds: z.number().int().positive(),
+    max_count: z.number().int().nonnegative().optional(),
+    max_amount: velocityAmountSchema.optional(),
+});
 export const PolicySchema = z.object({
     version: z.literal(1),
     max_amount: amountSpecSchema,
@@ -28,5 +40,11 @@ export const PolicySchema = z.object({
         .min(1),
     max_timeout_seconds: z.number().int().positive(),
     require_human_above: amountSpecSchema.optional(),
-    unknown_payee: z.enum(["review", "deny"])
+    unknown_payee: z.enum(["review", "deny"]),
+    max_auth_validity_seconds: z.number().int().positive().optional(),
+    allowed_spenders: z.array(addressSchema).optional(),
+    disallow_unlimited_approvals: z.boolean().optional(),
+    velocity: z
+        .object({ windows: z.array(velocityWindowSchema).min(1) })
+        .optional()
 });

package/dist/types.d.ts

@@ -10,6 +10,19 @@ export interface Asset {
     address: string;
     network: string;
 }
+export interface VelocityAmountSpec {
+    value: string;
+    decimals: number;
+    asset?: string;
+}
+export interface VelocityWindow {
+    /** Rolling window length in seconds (e.g. 300, 1800, 18000). */
+    window_seconds: number;
+    /** Max number of transactions allowed in the window. */
+    max_count?: number;
+    /** Max aggregate amount allowed in the window. */
+    max_amount?: VelocityAmountSpec;
+}
 export interface Policy {
     version: 1;
     max_amount: AmountSpec;
@@ -20,4 +33,11 @@ export interface Policy {
     max_timeout_seconds: number;
     require_human_above?: AmountSpec;
     unknown_payee: UnknownPayee;
+    max_auth_validity_seconds?: number;
+    allowed_spenders?: string[];
+    disallow_unlimited_approvals?: boolean;
+    /** Optional rolling-window rate and spend-pattern limits. */
+    velocity?: {
+        windows: VelocityWindow[];
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paystage/policy",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared spending policy schema and loader for PayStage agent payment tools",
   "license": "MIT",
   "type": "module",
@@ -13,7 +13,8 @@
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "!dist/**/*.map"
   ],
   "engines": {
     "node": ">=20"
@@ -45,11 +46,11 @@
     "prepublishOnly": "npm run typecheck && npm run build"
   },
   "dependencies": {
-    "zod": "^3.23.8"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",
     "typescript": "^5.5.4",
-    "vitest": "^2.0.5"
+    "vitest": "^4.1.12"
   }
 }